CVE-2026-93029

Severity: critical (CVSS 9.0 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-02 · updated 2026-10-02
Weakness: CWE-79

Description

There is a stored XSS vulnerability allowing arbitrary code execution in the WHM Manage SSL Hosts interface.

Affected products

WebPros cPanel: before 11.138.0.11; before 11.136.0.45; before 11.134.0.61; before 11.110.0.148 — fixed in 11.110.0.148, 11.134.0.61, 11.136.0.45, 11.138.0.11
WebPros WP Squared: before 11.138.1.13 — fixed in 11.138.1.13

How to fix

Upgrade to a fixed version: WebPros cPanel 11.110.0.148, 11.134.0.61, 11.136.0.45, 11.138.0.11; WebPros WP Squared 11.138.1.13. Check the vendor advisory for mitigations.

References

https://docs.cpanel.net/changelogs/110-change-log/#1100148
https://docs.cpanel.net/changelogs/134-change-log/#134061
https://docs.cpanel.net/changelogs/136-change-log/#136045
https://docs.cpanel.net/changelogs/138-change-log/#138011
https://docs.wpsquared.com/changelogs/versions/changelog/#138113
https://hackerone.com/reports/4047106
https://support.cpanel.net/hc/en-us/articles/43845929235351-Security-CVE-2026-93029-Stored-XSS-in-WHM-s-Manage-SSL-Hosts-Interface-September-29-2026

Get alerted when CVE-2026-93029 or the next vulnerability affects your stack